Privacy Policy

Last Updated: 27 October 2026

1. Introduction

Torrens ("we," "our," or "us") is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application for seeing your time and your money together.

Torrens is run by Torrenapps (Torrenapps Limited, Kenya, registration in progress; until registered, Brian Nkanata trading as Torrenapps), Nairobi, Kenya, which decides how your information is used. Contact: hello@torrenapps.com.

2. Information We Collect

2.1 Personal Information

supplied by Google when you sign in; the times your profile was created and last changed; and your time zone, saved the first time you sign in so that a week starts and ends where you are (on the web it is your browser's time zone; in the Android app it is the time-zone name your phone is set to, for example Africa/Nairobi; in the iPhone app it is also your phone's time-zone name, saved only when none is saved yet). Google's sign-in service, Firebase Authentication, also keeps your Google account identifier, when your account was created and when you last signed in

and your browser keeps you signed in (§10.1)

theme and a notifications setting. Your currency starts from the region in your device's language setting, when that names a region we know, and is blank otherwise. We ask you once to confirm or choose it, and you can change it in Settings at any time; what you already recorded keeps its currency. Your profile also keeps the exchange rates you have saved: the rates you typed or confirmed when you recorded a move between currencies, including those you typed under a currency you used before, and when you saved each one. They fill in the rate box for you to see and change, and an amount is never converted with a rate we have not shown you. The notifications setting sends you nothing (§6.3)

2.2 Time and Financial Information

saves the number of minutes, the week it belongs to, whether it adds to or corrects an earlier entry, that you typed it in on the web, and when it was saved

summary, worked out from your entries: hours worked, hours free, a split of hours by category, the money that came in that week and its currency, what one hour of your work was worth, and when it was last updated. A week is counted in one currency: the currency of the most recent money you recorded as coming in that week, leaving aside money that carries a rate you saved into another currency (that money is added at its rate instead), or your own currency when there is no such money. An amount in another currency is added only at the rate you saved with it, and only when you saved that rate against the week's currency; any other amount in another currency is left out, and the card says how many amounts were left out. Until you have chosen a currency, the week keeps your hours and no money. The "This week" card on the home screen and the week line on the transactions page show these figures, worked out from your transactions each time you open them, so the stored summary is only a copy

thought. The application saves the words you typed (up to 5000 characters, with any "<" and ">" taken out), how much effort and how urgent it is (low, medium or high) only if you chose them, when it was saved, and that it is still waiting to be sorted. It is saved in your account, and the database refuses any other signed-in account that tries to read it (§4.3). The web does not show your captures back to you yet. If you are offline, the capture waits on your device and is sent when you are back online. Your captures are included in the copy of your data (§6.1) and are deleted with your account (§7.2)

move between two of your accounts), the application saves the amount and its currency, the account, the category if you chose one, the date, the note if you wrote one, and how it was paid. For a move between accounts, or an amount in a currency other than the one you chose, it also saves the rate you typed. It first writes a pending request holding the same details, the currency your money was being counted in, the table of exchange rates in use at that moment and what you asked for (to record, change or delete), and the request is completed afterwards (§4.1). The completed record keeps that currency and that table of rates, so a later change or deletion can be undone exactly even after you change your currency. You can see, change or delete a record you made, and deleting one removes it from your list

goals, debts, scheduled items, categories and other money records for your account, as the Torrens apps let you enter them. They get the same protection, export and deletion as everything else

alerts. This web application does not read your messages or notifications. On Android it needs two things from you: your separate consent for message capture, and notification access, which you allow in your phone's system settings. The Android app cannot give that consent: it only reads the choice stored in your account, and does nothing while there is none. You can give it, and take it back, on the web in Settings, with the switch "Read my money messages on my phone": that records your choice in your account (first a dated entry in your consent record, then your current choice) and the web itself still reads nothing. Unless you gave it there or in the iPhone app, the Android app saves nothing from your messages. The Android app can withdraw the consent: in its capture settings, the switch "Read my money messages", turned off, writes your withdrawal to your account (first a dated entry in your consent record, then your current choice), deletes the message text waiting on the phone, and stops the app reading notifications. If the withdrawal cannot be saved, the switch stays on, nothing is deleted, and the app says so. With notification access, Android lets the app see every notification your phone shows. The app reads the title of each one to find the senders it accepts: M-Pesa, I&M, KCB and Standard Chartered. It keeps and sends nothing from any other notification. From an accepted one, the app keeps the text of the message on your phone, encrypted, for up to 7 days. You can see it in the app's capture settings and clear it there. That text is never sent to us. What is saved in your account is only what the app works out from the message: the amount, any fee, the balance the message stated, the sender, the other party's name, up to 120 characters as the message prints it, reference codes, the last digits of an account or card number, the time, the currency, and what kind of payment it was

or your notifications. It looks at a message only when you paste it into the app or share it to Torrens, and it never keeps the text of that message. When you share a message, Torrens works out the same values listed above for Android, and the iPhone keeps only those values, not the text, until you open the app and save or dismiss them. They wait on your phone with no time limit, in storage shared by the app and the share button, which the app does not encrypt itself. Nothing reaches your account until you save it, and then only if you have given your separate consent for message capture. The first time you save, the app asks "Allow" or "Not now"; "Not now" writes nothing, and "Allow" records your consent. You can also turn consent on or off in the app's Settings, with the switch "Read my pasted money messages". Turning it off writes your withdrawal to your account (first a dated entry in your consent record, then your current choice) and deletes the shared messages waiting on the phone. If the withdrawal cannot be saved, the switch stays on, nothing is deleted, and the app says so. If you withdraw on the web, on another phone, or by email (§6.1), the iPhone deletes the messages waiting on it the next time you open the app's home screen. A message you share after a withdrawal is kept on the phone until you answer "Allow" again, and is deleted if you withdraw again

2.3 Technical Information

The application itself collects no device information, other than what the next two sentences say, and sends no error reports. Feedback sent from the Android app carries the platform ("android") and the app version, and survey answers carry the app version. Feedback sent from the iPhone app carries the platform ("ios") and the app version. The services that run it keep request logs, described at the end of this section.

Analytics are part of the optional experimental programme (§16), and nothing is recorded for anyone who has not joined it. For people who have joined, the application can send events with any of seventeen event names to Plausible (§16.6), once we have set up an account there. It does not send the pages people open. None of them carries a money amount, a balance or an account identifier. See §10.2 and §11.1.

on your device only: your signed-in session; a copy of the data you have opened, so the application works without a connection; whether you last chose Money or Time; whether you have closed the experimental-build banner (it comes back after seven days); that the programme question has been asked; and a short list of the money records, changes and deletions you asked for whose result the application has not yet shown you (an identifier for each, never an amount), so the result is still shown, once, if you reload or close the page first. If you have joined the programme, it also remembers which version you last used and how many visits you have made, to decide when to offer a survey. Signing out ends your session and clears that short list but leaves the rest; deleting your account clears it too. Clearing this site's data in your browser removes all of it.

copy of the data you have opened on your phone, so the app works without a connection. The app does not encrypt that copy. It also keeps a few small settings: whether you last chose Money or Time, whether a banner is closed, whether the money screens are locked, and when you last used the app, so it can sign you out after a time without use. The message text described in §2.2 is kept there too, encrypted, for up to 7 days

have opened on your phone, so the app works without a connection. The app does not encrypt that copy. It also keeps a few small settings: whether you last chose Money or Time, whether the money screens are locked, when you last used the app, so it can sign you out after a time without use, an identifier (never an amount) for each money record you asked for whose result the app has not yet shown you, and whether a banner is closed. It also keeps the values from messages you shared and have not yet saved or dismissed (§2.2), with no time limit and without encryption of its own, until you act on them or withdraw your consent

Google, which runs Firebase Authentication and Cloud Firestore, and Vercel, which serves this application, keep logs of requests to their services, which can include your IP address and browser type, under their own policies.

3. How We Use Your Information

3.1 Service Provision

list of the money you record (which you can change or delete), the "This week" view of your hours and money, and the optional feedback and survey programme

money-in records you made

(§14). A small, named group of people at Torrenapps reviews feedback and survey answers (§16.5)

3.2 Security and Compliance

account's (§4.3)

We do not watch your account for suspicious activity and we run no fraud detection. We keep no log of who opened your records. The only access log is the record of each reviewer export (§16.5).

3.3 Service Improvement

Outside the optional experimental programme (§16), the only information about how you use the application that reaches us is feedback you choose to send. For people who have joined, we also use the survey answers and named events described in §16. We use all of these to improve the application, and for nothing else.

We do not carry out research on financial behaviour, and we do not combine or anonymise user data into datasets.

4. Data Storage and Security

4.1 Storage Infrastructure

Google Cloud Firestore, encrypted at rest by Google (§4.2)

Africa region

for 7 days. We can also restore the database to any moment in the last 7 days. These exist so we can recover from a fault or a mistake of ours. They are not a service for getting back something you deleted on purpose, and we do not promise to restore an individual record on request. When data is deleted it is removed from the live database, and copies can remain in these backups for up to 7 days, after which they are gone. Keep your own record of anything important. You can ask us for a copy of your data at any time (§6.1)

Android app and the iPhone app on your phone, each under your own sign-in. As of the date at the top of this policy, no code of ours runs on a server for your data. When you record money, completing it may be done by our own code running on Google Cloud once that is switched on; that code reads and changes your data to do so

4.2 Encryption Standards

(or your phone) and Google or Vercel

using Google-managed keys

stored, so we, as the operator, can read your stored data. The one exception is the message text kept on your phone: The Android app encrypts the message text in §2.2, and it never reaches us

4.3 Security Measures

any attempt by one signed-in account to read or change another account's data. It does not stop us, as the operator, from reading it (§4.2)

the only way to sign in. We hold no password. We do not add two-step verification of our own; if you use it, it is the one on your Google account. The application signs you out after 30 minutes of inactivity. It shows a 30-second warning first, on every screen while you are signed in, so you can stay signed in.

We do not monitor this application for attacks (§12.1) and have had no independent security test (§15.2).

5. Data Sharing and Disclosure

5.1 We Do Not Sell Your Data

§5.2.2

5.2 Limited Sharing Scenarios

We may share your information only in the following limited circumstances:

5.2.1 Service Providers

stores and serves your data, and Vercel serves the application itself. These are the only processors your data reaches, except that for people in the experimental programme, Plausible (§16.6) also receives programme analytics once we have set up an account there

We use no other analytics provider, no fraud-detection or security-monitoring service, and no third-party customer-support tool.

information. On the web, the one consent is for the experimental programme (§16). You are asked once after you first sign in, and you can join in Settings or leave in Settings or by email (§6.2). Joining is what allows survey answers, answers about you and named events to be recorded, and analytics to be sent to Plausible (§16.6). Feedback is different: anyone signed in can send it, whether or not they have joined. Each choice, including "Not now", is saved with the consent version and the time

from the programme's. It can be given in the iPhone app, with the "Allow" prompt or the switch in its Settings, and on the web, with the switch "Read my money messages on my phone" in Settings; the Android app cannot give it. It can be withdrawn on the web in Settings, in the iPhone app's Settings and in the Android app's capture settings, or by email to hello@torrenapps.com (§6.1). Every grant and every withdrawal is saved as a dated entry in your consent record, with the consent version and the time, and your current choice is saved beside it. Withdrawing stops new captures and deletes what is waiting on your phone (§2.2); a withdrawal made on the web reaches a phone the next time that phone checks, not at once. What was already saved to your account stays until you delete it (§6.1)

not send it to any other service; what you do with it afterwards is yours

5.3 Data Anonymization

We do not produce anonymised or combined datasets from your records, and so we do not use any.

6. Your Rights and Choices

6.1 Access and Control

You have the rights below. You use them by emailing hello@torrenapps.com (§14.2). We act within 30 days.

of the data we hold about you, including your quick captures, in one file a computer can read (JSON), with each money amount next to its currency. If any part could not be included, we tell you which part and why

record you made yourself. You can also ask us to correct or delete any record we hold about you

captures, from the database and then your sign-in record, and tell you when it is done. If anything could not be deleted, we tell you what remains

for message capture (§2.2) or for the experimental programme (§16) by email, as well as in the apps. We record the withdrawal in your consent record and it takes effect from then; it does not undo what was done before

6.2 Privacy Settings

email, push or SMS message (§6.3). The notifications setting on your profile has no effect

capture has a separate one (§2.2). For the programme you are asked once after you first sign in — "Join the programme" or "Not now". You can leave at any time in Settings, or by emailing hello@torrenapps.com, and you can join later in Settings. Leaving stops new surveys being offered and stops new events being recorded. It does not recall anything already sent and does not delete what was already written (§16.4)

6.3 Communication Preferences

This application sends you no messages of any kind: no marketing email, no service email, no push notification and no SMS. There is nothing to opt out of. If we need to tell you something important, such as a change to these documents or a personal-data breach, we write to the email address on your Google account (§12.2, §13.2).

7. Data Retention

7.1 Retention Periods

We keep your data until you delete it.

15 months after they were written (§16.3, §16.5). That automatic deletion is not switched on yet, so they stay until you delete your account or we delete them

last signed in; we do not use it to delete anything

gone (§4.1)

An account you leave without deleting it keeps its data.

7.2 Data Deletion

database and then your sign-in record. It is not instant

and you can ask us to delete other individual records without deleting your account

remains

After records are removed from the database, Google's storage takes its own time to erase them, and we cannot give a figure for it

8. International Data Transfers

8.1 Data Location

Your data is stored in Google Cloud's Johannesburg, South Africa region. Sign-in records are held by Firebase Authentication, which Google processes in its own data centres; these may be outside Kenya and South Africa, including in the United States. Vercel serves the application from its own servers, which may be outside Kenya, and keeps logs of requests, including your IP address. It stores none of your Torrens records.

8.2 Transfer Safeguards

Data moves between your browser or phone and Google (your data and sign-in), and between your browser and Vercel (the application itself). Google is our processor, and Google's terms apply to your data. We have no binding corporate rules, take part in no certification scheme, and have signed no standard contractual clauses of our own.

9. Children's Privacy

9.1 Age Restrictions

when you sign in, on the web, in the Android app or in the iPhone app. The 18 or over rule is a condition of use that we state; the application does not enforce it

10. Cookies and Tracking Technologies

10.1 Cookies We Set

None. This application does not set any cookie.

Your signed-in session is kept in your browser's own storage, not in a cookie. The other items the application keeps in your browser are listed in §2.3. The Google sign-in window is a Google page; anything it stores belongs to Google and is covered by Google's policy.

10.2 Analytics Cookies

None. No analytics cookie is set. The programme's analytics (§16.6) uses no cookie.

This application sets no cookie. To remove the items listed in §2.3, clear this site's data in your browser; this also signs you out.

11. Third-Party Services

11.1 Integrated Services

These are the services that receive your data, together with Plausible (§16.6) for people in the experimental programme once we have set up an account there. The application uses no AI or machine-learning provider. It does not ask for, and blocks, access to your microphone, camera, location, payments and USB devices.

11.2 Third-Party Privacy

policy and terms

stores and authenticates on your behalf, the requests Vercel serves when you load the application, and, for programme members, what Plausible receives (§16.6)

We do not audit third parties against a security standard of our own.

12. Data Breach Notification

12.1 Breach Response

We do not run automated breach detection or monitoring on this application, so we may learn of a breach from someone else. When we learn of one, we act as §12.2 sets out.

12.2 Notification Process

Where GDPR applies, we must notify the relevant supervisory authority within 72 hours of becoming aware of a personal-data breach, and notify affected people without undue delay where the risk to them is high (Articles 33 and 34).

If a breach affects your data, we tell you by email to the address on your Google account. This depends on our learning of the breach (§12.1) and on that address still being yours. The application itself sends no email, push notification or SMS (§6.3).

13. Changes to This Privacy Policy

13.1 Policy Updates

13.2 Notification Methods

If we make a material change, we email the address on your Google account. Every change to this policy also changes the "Last Updated" date at the top of this page.

14. Contact Information

14.1 Privacy Inquiries

If you have questions about this Privacy Policy or our data practices, contact us at:

We have not designated a Data Protection Officer.

14.2 Data Subject Requests

To use your access, portability, correction or erasure rights (§6.1), email us.

"Delete my account"

14.3 Complaints

If you have concerns about our data practices, you can:

is the Office of the Data Protection Commissioner (www.odpc.go.ke)

15. Compliance and Certifications

15.1 Regulatory Compliance

We handle your information under the Kenya Data Protection Act 2019 and, where it applies to you, the EU General Data Protection Regulation. No regulator or auditor has assessed this application against either.

15.2 Security Certifications

We hold no security certification and have had no independent security audit or penetration test.

16. Experimental Programme

Torrens is presently an experimental build, offered for anyone, anywhere, to try and to help shape. This section describes the additional, optional programme layered on top of everything above; nothing in it changes the data described in §2–§15, and nothing in it is required to use the application.

16.1 The controller for this programme

This programme is run by Torrenapps (Torrenapps Limited, Kenya, registration in progress; until registered, Brian Nkanata trading as Torrenapps), based in Nairobi, Kenya. Contact: hello@torrenapps.com. This is the contact for the programme specifically; §14 above covers the application's general privacy contact routes.

16.2 What joining adds

Joining is a separate, explicit choice, offered once after you first sign in and withdrawable at any time in Settings or by email. Saying no, or withdrawing later, changes nothing else about the application — every feature described elsewhere in this policy works identically either way.

If you join, this programme collects:

joining, §5.2.3) — free text, an optional 1–5 rating, and the fixed tags you choose (bug, confusing, idea, pricing, capture, seasons, loop, trust, other), together with the screen you were on, the app version, and the mode (Money or Time) you were in; feedback sent from the Android app also carries the platform ("android"), and from the iPhone app ("ios")

one-time pricing question

as an event name, the time and the few details listed in §16.6. Saving a quick capture (§2.2) is one such event: it records how much effort you chose, if you chose one, and whether it was morning, afternoon, evening or night where you are (read in the time zone saved on your profile), and never the urgency you chose. Never a screen recording, never what you typed, and never the contents of an amount you entered

whether your income is steady, seasonal or a mix, an income band (optional, in plain words such as "enough most months", never an amount), an age band, your country, and the tool you use today to track your money or time. Occupation, country and the tool are words you type; the others you pick from a list. All but the income band are needed to finish joining. They are saved on your profile

We do not read your transactions, balances, goals or any other financial content as part of this programme. Amounts you enter into the app are never collected here, in any form, regardless of what mode you were in when you gave feedback.

16.3 Retention

Feedback and survey responses are meant to be deleted 15 months after you give them. That automatic deletion is not switched on yet, so until it is they stay until we delete them or you delete your account. Your answers about you (§16.2) stay on your profile until you delete your account.

Named events are held only in memory in your own browser session. If you have joined, they are also sent to Plausible (§16.6), once we have set up an account for this application there.

16.4 Withdrawing

You can withdraw from this programme at any time in Settings, or by emailing hello@torrenapps.com. Withdrawing stops new surveys being offered and stops any new event from being recorded, immediately, and nothing more is sent to Plausible from the moment you withdraw. It cannot recall what was already sent. It does not delete or anonymise anything already written. Account deletion (§6.1) does that, and it reaches everything this section describes, with one exception: a reviewer's own export log (§16.5) is not deleted with the reviewer's account.

16.5 Who can see this

Feedback and survey responses are read only by you and by the small number of people at Torrenapps who review them to improve the application. We keep the list of reviewers ourselves, outside the application; no one can add themselves to it. Every time a reviewer exports feedback or survey responses, that export is logged under the reviewer's own account, not yours. The log entry is meant to be deleted 15 months after the export, the same window as §16.3, and is not deleted when the reviewer deletes their own account: it is our record of how testers' data was handled.

16.6 Sub-processors

This programme uses the same infrastructure named in §11 (Firebase Authentication and Cloud Firestore), plus one addition for the named events described in §16.2/§16.3: Plausible (plausible.io), an analytics service hosted in the EU that sets no cookie.

If you join this programme, Plausible receives, for each event: the event name (for example, that the weekly card was opened); the address of the website itself, never the page you were on; that the event came from the web application; the application version; the survey's short name for survey events; and, for a few events, a yes-or-no answer, a choice from a short fixed list (for example typed in by hand or from a captured message, whether a budget repeats every month, every year or once, or morning, afternoon, evening or night), or a whole number (minutes, milliseconds or a percentage). Like any website you visit, it also sees your IP address and browser type. It does not receive the address of any page you open, the page you came from, how long a page was open or how far you scrolled. It receives no amount, balance, account identifier or screen text.

As of the date at the top of this policy, no Plausible account has been set up for this application, so nothing is sent to Plausible.

This Privacy Policy is effective as of 1 October 2026 and was last updated on 27 October 2026.

By using Torrens, you acknowledge that you have read, understood, and agree to this Privacy Policy.